►
Description
How do you solve the security isolation problem of multi-tenant clusters? Security is a topic that comes up a lot when thinking about implementing DevOps with a GitOps workflow. In this episode we'll go over how role-based access control (RBAC) works and how you can tie it into the OpenShift authentication mechanism using Argo CD's RBAC configuration.
About ArgoCD:
Argo CD is an open source, declarative, GitOps continuous delivery (CD) tool which automates the deployment of services and applications in Kubernetes environments.
https://argoproj.github.io/argo-cd/
Follow us:
Christian Hernandez https://twitter.com/christianh814
Chris Short https://twitter.com/ChrisShort
What is GitOps Guide to the Galaxy?
Every other Thursday at 3am ET hosts Christian Hernandez and Chris Short sit down to discuss everything in the GitOps universe, from end-to-end CICD pipelines to creating Git workflows.
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on GitHub https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #GitOps #Kubernetes #ArgoCD #Argo
A
A
A
A
A
Good
morning,
good
afternoon,
good
evening,
wherever
you're
healing
from
welcome
to
another
episode
of
get
ops
guide
to
the
galaxy,
I
am
chris
short
executive
producer
of
open
shift
tv.
I
am
joined
by
my
fellow
red
hatter
and
teammate
the
one
and
only
christian,
hernandez
christian.
How
are
you
today,
sir?
I'm
doing
great?
How
are
you
hi,
hey,
I'm
I'm
hanging
in
I'm
going
to
t-ball
practically.
B
Okay,
all
right
nice,
all
right
I'll
I'll
I'll
check
up
on
you
after
that.
So
well,
what's
what's
interesting
about
this!
Today's
episode
is
that
it
was
something
that
someone's
been.
I
guess
someone
I
guess
most
people
have
been
asking
me
for
a
long
time
talking
about
are
back
in
argo
cd
and
it's,
and
I
decided
you
know
finally
to
to
dive
in
right
to
figure
out
argo.
B
It's
not
valid
so,
but
I
think
I'm
gonna
still
go
go
over
the
bulk
of
it
is
going
to
be
applicable.
So
for
me
it's
interesting
to
talk
about
our
back
and
argo
cd,
because
I
always
think
of
argo
cd
as
synonymous
with
get
ops
and
like
as
a
practice,
and
it's
like
not
necessarily
right.
You
know,
we've
always
said
chris
and
then
you
know
you
said
it.
B
A
lot
is
that
git
ops
is
a
practice,
not
a
tool
right,
but
I,
but
I
always
you
know,
since
argo
cd
can
be
used
for
get
ups.
I
always
use
it
synonymous.
So
I
always
when
people
say
our
back
with
argo
cd,
it's
like.
Why
are
you
doing
our
back
with
argo
cd
because
like
why?
Why
why
would
people,
even
log
into
argo
city
like
like
for
me,
like
as
a
get
ops
practitioners
like
you're,
doing
everything
through
get?
So
why
do
you
need
to
log
into
argo
city,
but
so.
A
A
A
B
A
B
At
the
tail
end
of
their
ci
cd
process,
right
cd,
obviously
argo
cd,
so
in
those
cases
it
makes
a
lot
of
sense
right.
For
me,
it's
like
oh
yeah.
That
makes
you
know
if
you're
not
doing
you
know,
100
get
ops
using
it
as
a
you
know,
in
your
event,
driven
architecture,
it
does
make
sense.
You
do
want
to
log
in,
and
you
know,
initiate
some
syncs
pause.
Some
things
do
some
troubleshooting
that
that
completely
makes
sense.
So.
B
A
B
Yeah,
like
let
me
take
a
look
around
like
how
do
I
troubleshoot
so
so
in
my
in
in
my
core
right
in
my
core
belief,
my
core
get
ops
right,
like
you're
doing
get
ups.
My
opinion
is
that
you
do
most
of
it
through
get
workflows,
so
you
don't
necessarily
need
to
log
into
argo
city,
but
there's
a
lot
of
other
workflows
out
there
and
you
actually
do
need
to.
You
know
leverage
some
of
the
capabilities,
so
I'm
going
to
do
a
first
hold
on.
A
B
A
A
B
For
you
guys
who
don't
know
andrew
does
a
a
show,
ask
openshift
admin
wednesdays
right,
so
he
does
something
similar.
He
kind
of
just
trolls
through
the
the
documentation,
the
there's
something
that
red
hat
is
working
on.
A
lot
is
that
how
do
I
put
this
nicely
the
documentation?
It
leaves
much
to
be
desired,
so
there
was
so
there's
some
stuff
that
is
missing
right,
some
of
the
stuff
that
we're
trying
to
quickly
ramp
up
on.
B
A
B
B
B
Clue
for
for
those
out
there
who
are
looking
to
break
into
the
open
source
software
open
source
world
documentation,
people
will
love
you
so
yep
yeah.
So
let's
talk
about
before
we
like
dive
into
like
what
the
our
back
is
actually
doing
in
argo
city.
I
want
to
talk
about
a
couple
of
concepts
of
avargo
city
right.
So
let's
go
to
the
core
concepts
here.
Let
me
go
to.
B
Let
me
put
this
in
the
chat.
Read
the
docs
or
go
cd
read
the
docs
just
you
know
so
you
know
so
first
thing
is
application
right.
I
kind
of
just
discussed
this
a
little
bit
before
in
other
shows
and
if
you're
using
argo
cd,
you
kind
of
get
the
concept
right
and
so
an
application
right.
The
capital,
a
application,
is
an
actual.
B
B
B
B
Is
not
an
application
you
can
define
that
you
can
define
you
can
define
what
an
application
is
so
for
me
is
all
the
manifests
that
make
up
my
application.
It's
a
logical
collection
right
and
so,
and
that
is
a
a
resource
type
right
and
and
the
reason
why
I
want
to
mention
some
of
these
core
concepts
is
that
our
back
is
going
to
apply
to
some
of
these
concepts.
B
One
that's
not
being
here
is
called
a
project
and
so
openshift
users
kind
of
get
a
little
bit
confused.
I
was
about
to
say
yeah
yeah
when,
if
you're
a
kubernetes
user
in
openshift
land,
a
project
encompasses
a
lot
of
things
right
in
terms
of
like
metadata
network
policies
or
whatever,
but
it's
logically
grouped
it's.
A
B
Like
it's
a
logical
collection
of
these
little
things,
but
for
another
show
for
andrew's
show,
and
so
but
a
project
is
in
conceptually
is
the
same
of
inside
of
openshift
as
it
is
in
argo,
cd.
There's
a
few
key
differences
projects
is
the
logical
grouping
of
applications.
So
essentially
is
a
it's
a
way
to
get
like
that.
Multi-Tenant
names,
I
guess
ability
right
so
like
you
can
create
a
project
called.
B
I
don't
know
foobar
right
and
it
may
house,
you
know
30
or
40
applications
and
and
you'll
do
a
lot
of
your
r
backs
specifically
to
a
project.
So
it's
like
it
says
here
it's
useful
when
you,
when
you're
using
argo
cd
by
multiple
teams
right
so
you
can
get
kind
of
like
a
multi-tenant
like
team,
a
can
look
at
you
know,
project
foo
team
b
can
look
at
project
bar
in
the
same
argo
instance
and
like
they
don't
know
about
each
other
right.
B
B
What
is
it
the
overarching
control
bit
or
I
don't
even
know
how
to
how
to
articulate
this?
Is
that
in
in
in
openshift
kubernetes
like
the
namespace
is
like
the
is
it's
like
the
isolating
thing,
but
it's
it's
in
on
the
top
of
the
hierarchy,
essentially
because
you
have
like
the
namespace
project,
the
name
of
your
deployment
right
and
all
these
things
are
related
to
that.
B
The
view
of
the
world
is
from
the
applications
point
of
view
right
and
it
makes
sense
for
argo
city.
It's
meant
to
deploy
your
applications.
Your
applications
can
span
many
namespaces
right
like
you're.
Just
because
you
have
an
application,
it
doesn't
necessarily
tie
it
one-to-one
and-
and
so
you
know,
you
can
have
an
application
made
up
of
like
lots
of
micro
services
across
a
lot
of
name
spaces
right
in
each.
You
know
have
their
own
little
things.
B
You
know
it's
it
by
default,
everything
lands
there
if
you
don't
specify
which
is
different
than
the
default
project
and
openshift
slash
namespace
kubernetes,
because
that's
like
restricted
right.
That's,
like
you
know,
that's
the
the
default
project.
It
has
it's
like
its
own
thing.
You
never
deployed
to
it
that
sort
of
thing,
but
here
on
argo
you
deploy
to
the
default
project,
so
you
can
create
projects
and
maintain
projects.
B
You
know
kind
of
just
like
how
you
would
do
name
spaces,
and
so
then
you
have
roles
within
that
project,
and
so
this
here
is
actually
when
I
want
to
like
move
away
from
projects
a
little
bit
and
let's
I
want
to.
Let's
do
our
back.
Our
back
configuration
okay,
so
a
few
things
about
our
back
and
argo
are
back
in
argo,
that's
hard
to
say,
yeah.
B
And
100
admin
so
0
and
100
right
all
or
nothing,
okay,
all
or
nothing.
So
that's
the
default
role
roles
in
inargo
city,
so
this
makes
it
a
little
bit
laborious.
I
guess
in
anything
else
that
you
need.
You
have
to
build
yourself.
So
essentially
there's
a
there's,
a
it's
very,
very
granular,
right,
it's
like
very,
very
specific
and
so
you'll
set
a
policy.
B
You
have
to
write
your
own
policy
right,
so
anything
outside
of
100
admin
and
read-only.
You
have
to
build
it
yourself
essentially,
and
so
you
have
things
like
p
stands
for
policy
right,
and
then
you
specify
the
the
role
user
or
group
right.
So,
like
you
know,
if
you
create,
if
you
say
role,
you
know
admin
or
user
bob
or
group,
you
know
developers
right,
you
have
to
specify,
or
I'm
going
to
create
a
policy.
That's
going
to
apply
to
this
guy
resource
right.
B
So
whatever
the
resources
are
so
resource
is,
is
a
list
like
clusters
right
as
a
resource
project,
is
a
resource?
Applications?
Is
the
resource
right
repository,
so
like
you're,
gonna,
say:
okay,
I'm
gonna
create
a
policy
that
is
targeting
this
role.
User
group
for
this
specific
resource
and
what
action
that
you're
going
to
allow
right
so
you're
gonna,
say
get
right
like
I'm
gonna
allow
get
to
to
this
resource
right.
I
want
to
allow
them
to
update.
I
want
to
allow
them
to
sync.
B
B
B
What
action
right
delete?
What
specific
thing
right
like
all
of
it
right,
so
you
can
do
either
everything
or
a
subset
of
it.
I
want
to
allow
that
right,
yeah
and
then,
and
then
you
set
up
your
groups
right
that
you
can
set
up
your
group
group
mapping
here.
So
I'll
get
oh
I'll
explain
what
the
group
mapping
is
in
a.
A
A
B
Db
admins
for
all
applications
be
able
to
create
applications
in
this
project
and
this
argo
project
yeah
in
this
argo
project,
alright,
good,
good
yeah.
You
need
to
specify,
because
we're
talking
about
different
projects
in
this
argo
project,
all
of
them
right
so
allow
delete
all
everything
right,
be
able
to
get
everything
things
like
that,
and
so
here
testing
policy.
A
B
This
it
gets
kind
of
confusing,
because
what
what
you
need
to
do
is,
since
you
have
only
read
only
an
admin
when
you
deploy
argo
cd,
you
need
to
be.
You
need
to
tell
it
specifically
hey.
I
want,
I
want
to
create
a
policy
right,
so
you
create
your
policy.
I
want
to
create
the
group,
and
I
want
to
map
the
users
to
this
group,
and
then
I
want
to
map
this
group
to
something
else
right
and
when
I
mean
something
else.
B
There's
a
section
about
oauth
here,
so
you
can
oh
overview.
Let's
try
overview.
I
found
that
this
page,
so
this
is
local
accounts.
We're
not
gonna
do
local
accounts,
because
no
one
cares
so
here.
So
here
is
the
section
here.
So
argo
cd
can
connect
to
your
authentication
provider
using
oidc
right,
so
that's
kind
of
like
the
generic
connector
yeah
so
like
if
you're
using
ldap,
github
saml
right.
B
Whatever
argo
cd
supports
that
the
only
the
only
problem,
I'm
gonna
call
that
a
problem
no
more
challenges
right,
because
because
it
is
a
problem,
I
think
openshift
doesn't
support
native
oidc
connectors
right,
and
so
I'm
not
sure
why
there
was
decision
made
before
my
time
but
open.
You
can't
use
oitc
natively
inside
of
openshift,
so
you
need
to
use
a
way
to
to
bridge
these
together
right
and
for
the
longest
time.
B
Dex
was
used
and
dex
was
a
popular
method
of
doing
this,
just
because
of
its
lightweight
and
simplicity.
Right
right,
so
like
all
it's
doing
is
just
taking
how
you're
logging
in
and
passing
that
to
this
other
thing:
yeah
this
other
provider.
So
and
so
oh
it's
a
picture
of
jesse
he's
one
of
the
engineers
on
in
the
intuit
side.
I
mean
how
funny
I
see
his
picture
here
and
you
can
do
this
via
it's.
Essentially,
it's
a
config
map
in
argo,
cd.
B
B
Whatever
right
and
specify
the
scopes
and
things
like
that,
so
even
in
the
open
source
upstream,
we
actually
made
this
easier
via
the
operator
right,
the
upstream
operator.
So
what
I'm
going
to
do
is
I'm
going
to
go
through
an
example.
I
have
for
using
decks.
So
a
few
caveats
right,
so
one
this
isn't
supported.
B
Out
it's
just
flat
out
does
not
support
it,
so
it's
not
supported
because
we
don't
we
don't
support
decks
officially,
so
there's
no
official
support
for
decks.
So
therefore
it's
just
not
we
just
can't
use
it
right
so
and
so
yeah,
so
we're
using
we're
gonna
use
dex.
This
is
like
the
old
way
of
doing
it,
and
then
I'm
gonna
go
through
like
the
new
way
of
doing
it,
but
this
will
kind
of
just
show
how
it's
yeah
dex
is
not
supported.
So
this
is.
B
A
A
B
B
Is
the
the
and
here's
here's
a
a
good?
I
always
send
this
article
here.
It's
essentially
it's
it's
an
open
standard
of
how
of
identity
management
right,
I
guess
right
or
oidc
is
the
connector
right,
so
oidc
provider
is,
is
basically
an
implementation
of
of
open
id,
so
using
oauth,
2
and
all
that
stuff,
whereas
ldap
is
like
a
whole
full-fledged
right.
You
know
directory
server.
A
B
B
This
one
yeah
this
one
actually
is
a
pretty
good.
Pretty
good
read
it's
basically
an
open
standard,
yeah
of
identity.
So
so
where
was
it
oh
yeah
here
so
here
this
is
again
old
school.
This
is
version
1.8.2
we're
on
2.0
now
so
this
is
this
is
how
here
I'm
using
dex
and
then
here,
but
you
know,
that's
not
as
important
as
what
I'm
doing
here
right.
So
our
back
is
the
section
here.
So
let
me
shift
here
so
so
here.
B
A
B
Our
go
cd,
so
g
is
group
and
this
group
and
we
provide
a
role,
admin
right.
So
then
you're
going
to
think
like.
Where
does
this
group
come
from?
So
this
group
comes
from
openshift,
so
when
so,
this
is
kind
of
like
where
dex
comes
in,
like
the
oitc
provider.
Is
that
when
you
log
into
openshift
it's
going
to
pass
this
information
into
into
argo
cd?
So
it's
going
to
say
so.
B
Yeah,
so
this
yeah
say
this
user.
This
is
the
username.
This
is
the
group
they're
in
and
blah
blah
blah,
and
this
comes
through,
and
this
is
actually
the
cluster
admin
group
in
case
you
didn't
know,
system
cluster
admins
is
a
cluster
admin
group
and
I'm
going
to
assign
it
to
the
admin
role
in
inargo
cd
and
then
I'm
going
to
create
a
group
called
admins
and
again,
where
do
yeah
it's
gonna
map
it
right,
join
it
to
that
role.
B
Role
inside
of
argo,
cd
and
I'm
gonna,
say:
developer
right
developer
has
a
role
developer,
so
you're
now
you're
now
now
you're
thinking
now
you're
creating
roles.
Now
I'm
creating
roles,
correct
yeah.
So
now
I'm
just
because
now
where's
my
there
it
is
now.
You
know
remember
when
I
said:
there's
only
two
roles.
Now,
if
I
go
back
to
where's
my
there,
it
is
here
now
I'm
creating
them,
because
this
doesn't
exist
so
and
I'm
creating
a
marketing
group
right.
B
B
A
B
A
B
B
B
Yeah,
so
here
here's
here's
an
example.
So
what
I'm
going
to
do
is
I
create
a
project
right,
I'm
going
to
create
a
process,
argo
cd
project,
so
app
nargo
city,
app
project,
and
I
am
going
to
create
the
role
so
here
so
going
back
here
notice.
I
said
you
know:
marketing
gets
assigned
the
role
marketing
in
the
application
project.
B
B
Sorry
all
applications
in
this
project
right
so
allow
sync
right,
so
I
can
get
it
meaning
I
can
list
it.
I
can
sync
stuff
right
in
that
project
and
I
can
get
all
projects
within
this
project.
This
is
kind
of
something
weird
that
you
have
to
do,
but
for
it
to
work
right,
so
I'm
only
allowing
essentially
read
only
and
sync
so
here
since
I
didn't
like
list
like
delete
or
update
or
anything
like
that
right.
I
it
won't.
Essentially
it's
a
read-only
account
right.
B
B
B
B
B
B
A
B
B
A
B
B
B
B
A
B
A
A
B
A
B
A
A
B
A
B
B
A
B
B
A
B
B
A
A
A
A
A
B
A
B
A
B
B
B
B
B
B
A
B
A
B
Yeah,
well,
it's
it's
just
one
of
those
things
that
when,
when
we
say
supported,
it
means
that,
like
one
is
that
we
have
engineers
working
on
the
project
which,
actually,
ironically,
we
do
on
decks
because
dex
was
a
core
os
project
and
so
and
those
engineers
became
red
hat
engineers
and
they
still
work
on
decks
actually.
But
two
is
testing
right
and
testing
it
with
in
our
ci
process
right
and
we
just
don't
test
it
and
mainly
because
red
hat
has
its
own.
B
B
B
What's
the
chorus
we
took
that
we
took
that,
and
you
know
mushed
together
with
openshift
v3,
which
is
why
you
got
before,
but
some
of
the
things
just
didn't
come
over
and
so
that's
a
long-winded
answer
of
just
saying
it's
not
on
the
roadmap,
and
so
so
the
answer
is
it's
not
going
to
be
supported.
I
mean
right
now
it's
not
on
the
word
map
that
may
change,
but
right
now
it's
like
there's
it's
it's
not
even
one
is
it's.
I
guess
it's
such
in
the
backlog.
B
A
B
Yeah
that
can
change
right
like
if
enough
customers
ask
for
it.
I
mean
we
do
have
all
the
pieces
there.
It's
just
not.
You
know
we're
just
they're,
not
just
together
right.
We
have
the
engineers,
we
have
the
ability
to
test
it.
So
it's
it's
there.
All
the
pieces
are
there,
but
if
enough
enough,
people
do
an
rfe
with
customers
attached
to
it.
So.
A
B
A
B
B
B
A
B
Yep
using
oidc
for
argo
cd
and
then
you
create
the
group
claim,
meaning
that,
like
I
want
the
group
membership
to
come
through
right
via
the
when
you
log
in
and
then
and
you
need
to
take
that
token
it
generates
because
it
generates
a
token
and
then
base
60
for
it
and
load
it
into
argo
cd.
So
in
a
secret
here
you
load
whatever.
That
long
token
is
we.
B
B
Yes
right
now,
yes,
but
it's
there
so
in
case
you're
watching
that's
what
I
did.
That's
why
I
broke
so
you
do
the
od
oidc
connector,
and
you
do
this
essentially
you're
you're,
you're,
telling
argo
cd,
hey
use
this
oidc
configuration
and
connect
to
key
cloak,
and
so
that's
essentially
how
that
mapping
happens
first,
you
create
it
in
key
cloak.
B
B
And
you
know
everything
else:
is
it's
essentially
that
easy
to
get
cloak
up
and
running?
If
I
can
do
it,
anyone
can
do
it.
So
that's
like
that.
So
first
install
the
operator
and
then
you
deploy
an
instance
of
key
cloak
and
then
you
can
go
through
this
documentation
to
get
argo
cd.
Did
you
link
that
sorry
in
the
chat?
I
did?
Yes,
I
did
okay,
cool
good
chat,
so.